## TL;DR
A token in a public Slack channel is compromised the second it renders: revoke it in the Slack app admin panel immediately, then rotate, delete the message, and audit usage. Revoke first because automation may already be copying it; cleanup second.

## Error
```text
slack token leaked in public channel: revocation race
```

## Steps
1. Revoke now: open the Slack app's admin panel (or api.slack.com apps page) and revoke or rotate the leaked token immediately. Expected: the token stops authenticating within seconds.
2. Rotate dependents: if the token belonged to a bot or integration, issue a fresh token and update the integration's configuration. Expected: the integration runs on the new token.
3. Delete the message containing the token, and check thread replies and pins for copies. Expected: no visible copy remains in the channel.
4. Audit usage: review the app's activity and your workspace audit logs for calls made between the leak and the revocation. Expected: you know whether the token was abused in the window.
5. Find the leak source: determine how the token got pasted (a debug dump, a misconfigured notification) and fix that path. Expected: the same mistake cannot recur.

## When to use
- A Slack token appears in any channel, thread, or snippet
- Webhook URLs or bot tokens in shared workspaces
- Post-incident review of chat-based leaks

## When not to use
- Designing Slack app scopes (preventive, not incident response)
- Tokens leaked outside Slack (use the provider-specific rotation)

## Tool compatibility
- Slack app admin panel, workspace audit logs

## Variant phrasings
### bot token posted in slack channel
Revoke at the app level first; deleting the message alone leaves the token valid.

### slack webhook url leaked
Rotate the webhook URL in the app settings; anyone with the old URL can post as the integration.

## Why it happens
Chat is forever-ish: messages sync to many clients, get indexed, and are readable by every channel member plus integrations. Tokens in chat are also the most likely to be pasted by well-meaning debug output, which is why revocation must beat cleanup in the response order.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_nYvWICT49ECdp4OSJqBeVA